- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Single Value Visualization - Set value to always h...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a single value visualization with four values and I would like to set each value to have one color and to stay that color. For example I have a CRIT, HIGH, MED, LOW. I would like the CRIT to always be red, for HIGH to always be orange, for MED to always to be blue, and LOW always to be green. Is there a way to do this? I have tried a couple of options from browsing the forums but no luck.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@cooperjaram you have several options to do this:
1) Use single value with rangemap (Not recommended as any edit to Single Value from UI will override this). Refer to one of my older answers: https://answers.splunk.com/answers/569541/single-value-in-advanced-xml-color-and-result.html
2) Use Status Indicator Custom Visualization: You can add color as well as icon based on text. Refer to an older answer with option 1 and option 2 both: https://answers.splunk.com/answers/595910/how-to-build-a-dashboard-with-single-panel-value-b.htm
3) Use Simple XML JS extension to override Single Value color on render (you would need to know JavaScript to handle text values). Refer to one of the older answers which is based on numeric value but can be changed as per text as well. https://answers.splunk.com/answers/659702/how-to-configure-single-value-dashboard-color-base.html
4) Use <html> panel with CSS override based on text value in search result. Refer to older answer: https://answers.splunk.com/answers/675789/how-to-change-the-font-color-in-a-dashboard-depend.html
5) Use table with single result and apply color using UI. Use CSS override to hide table header and further style table cell as per need. One of the older answers to hide table header: https://answers.splunk.com/answers/587679/how-do-i-hide-table-headers.html
Please try out and confirm if any of the options work for you!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@cooperjaram you have several options to do this:
1) Use single value with rangemap (Not recommended as any edit to Single Value from UI will override this). Refer to one of my older answers: https://answers.splunk.com/answers/569541/single-value-in-advanced-xml-color-and-result.html
2) Use Status Indicator Custom Visualization: You can add color as well as icon based on text. Refer to an older answer with option 1 and option 2 both: https://answers.splunk.com/answers/595910/how-to-build-a-dashboard-with-single-panel-value-b.htm
3) Use Simple XML JS extension to override Single Value color on render (you would need to know JavaScript to handle text values). Refer to one of the older answers which is based on numeric value but can be changed as per text as well. https://answers.splunk.com/answers/659702/how-to-configure-single-value-dashboard-color-base.html
4) Use <html> panel with CSS override based on text value in search result. Refer to older answer: https://answers.splunk.com/answers/675789/how-to-change-the-font-color-in-a-dashboard-depend.html
5) Use table with single result and apply color using UI. Use CSS override to hide table header and further style table cell as per need. One of the older answers to hide table header: https://answers.splunk.com/answers/587679/how-do-i-hide-table-headers.html
Please try out and confirm if any of the options work for you!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Were you able to generate non-numeric Single value dashboards?
Single value is only numeric as per the doc and the examples shown. Could you share your code snippet and explain what you are trying to achieve?
https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/SingleValueGenerate
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
